This disclosure relates to database security and, more particularly, to methods, systems, and computer program products for providing a database security application, and systems and/or computer program products that implement such methods.
One approach for implementing security policies for restricting data access to data stored in a relational database is to embed the security logic within the applications that actually perform the data access. While an application-based security policy may provide a sufficient level of granularity (i.e., data access restrictions at the level of an individual user), it may not offer a sufficient level of security, because users with access to database query or reporting tools may be able to bypass the access control mechanisms implemented by the application. Moreover, any changes to the security policies may involve modifications to the application itself, which may require the time-consuming and expensive design, testing, and deployment of a new version of the application.
Another approach used in conjunction with application-enforced security is the use of a database object known as a “view.” A view can be a stored query that is accessible as a “virtual table” composed of the result set of the query. Views may be used to partition a database table into multiple “virtual tables,” each containing only a subset of the rows and/or columns present in the actual underlying database table or tables. However, the use of views may not be a practical means to implement a security policy, particularly where a large number of views is necessary. For instance, using views to limit a customer's access to their own records may be feasible if there are only 10 customers and, thus, 10 views, but may be impractical if there are 10,000 customers, requiring the design, testing, implementation, and maintenance of 10,000 separate views. Additionally, users with sufficient database access to the underlying tables may be able to bypass views and the security policies implemented therein.
“Virtual private database” (VPD) functionality provided by some databases may allow server-enforced, fine-grained data access control through the use of dynamic query modification to enforce security policies on database objects. VPD is discussed in more detail in, for example, U.S. Pat. No. 6,587,854 to Guthrie et al. and U.S. Pat. No. 6,606,627 to Guthrie et al., as well as in “Oracle Virtual Private Database: An Oracle Database 10 g Release 2 White Paper,” June 2005.